ImpREC lite v11 Source Code(Share)

News:
—–
ImpREC is back to public. This version can now support Windows 95 (Thanks to EliCZ,
Unknown One and ZigD for testing).
It has also been redesigned to support more import rebuilding schemes (relative calls for
example). The plugin interface has changed completely (using filemapping) and now supports
the ‘Exact Call’ feature. This last one has been linked with the ‘Create New IAT’. It will
be useful for all mangled schemes which annihilate completely or partially the IAT. The
‘AutoTrace’ is more stable because it will not use the Tracer Level2 anymore. A built-in
coloured disassembler/hew-viewer will help you to watch the redirected code. Then you
should not need the ASProtect plugin because of no more updates but it still is there as
example. Please take a look at <History.txt> for all details.

I hope you will enjoy this version like i did to make it,
Regards,

MackT/uCF.

v1.6 FINAL (PUBLIC VERSION)
—————————

– Misc

– Finally fixed the bug in the check for adding section (Thanks to Christoph)

v1.6 beta *PRIVATE*
——————-
– Tracers
– Tracer Level3
– Added EIP Log
– Misc
– Finally, support relative calls rebuild (not with the loader yet)
– Added a disassembler window for redirected code
– Added colour to all known imports (Thanks to Jeff Schering)
– Added a hex viewer (built with the disassembler)
– Fixed blink in RichEdit control
– Checkbox “OpCodes” is enable/disable depending on “Hex View”
(Thanks to Muffin)

Continue Reading

[DCC Error] E2161 Error: RLINK32: Unsupported 16bit resource in file “.dfm”

text

Delphi程序的郁闷之处就在于各种第三方的库处理起来太麻烦了,总是有人喜欢引入一些从来没见过的东西,于是编译的时候就变得非常蛋疼,不是库不好找而是不同的版本导致出现各种错误。比如alphacontrols这个鸟插件就测试了n个版本。其实这个不是最蛋疼的,最蛋疼的是处理完了所有的错误之后编译出现问题了:[DCC Error] E2161 Error: RLINK32: Unsupported 16bit resource in file “.dfm”

在网上搜索了一通说实话意义不大,知道后来发现这么一个东西:http://bbs.csdn.net/topics/40441840

里面有段文字提到了这个问题:

我好像遇到过类似的问题。
一个正常的Form,在设计时,在窗体上点击右键,最底下的“Text DFM”应该默认是打上勾的(表示该窗体的DFM文件是以纯文本形式保存的),但是如果那个勾去掉,则该文件用记事本打开的话看到都是一些乱码(具体是怎么保存的我没有深究过)。
我当时遇到这种情况是有三个人同时在开发一个模块,后来某一天突然发现某一个窗体在其中一个人的机器上打开时报类似于楼主的错误,我发现那个DFM文件用记事本打开看到的都是乱码,而在我的机器上又可以用Delphi打开那个窗体,把“Text DFM”打上勾之后保存再拿到那个人的机器上就可以打开了。
不知道你的文件是不是在不同的机器编写过,你用记事本打开看看是不是乱码,如果是的话应该就是跟我一样的问题。找一台可以用Delphi打开该文件的机器(上一次打开过这个文件的机器应该就可以),把“Text DFM”打上勾吧,呵呵。

而此处我的情况则恰恰相反,我是把那个勾去掉了就能编译了,唉,各种蛋疼的错误啊,错误。

Continue Reading

DeIDA Package 1.4

DeDe is Excellent Delphi program analyzing tool, but I still prefer IDA for
navigation & documentation.

Exe-2-Dpr is another very useful utility (and also work with old 16-bit Delphi
programs).

I always look for way to grab as many info from this great program’s output as
possible. So, I wrote a few stupid progs just to _reformate_ Exe2dpr & DeDe
output and import into IDA by simple IDC script.

That’s all.

How to use:
———–

EDM:

> -*- EDM 1.4 * Copyright (c) Aleph 2001-2003 -*-
> Exe-2-Dpr output files reformatter
> Usage: edm.com [> ProjectName.DDM]

Apply exe2dpr.exe to analyzed proggy. Place all exe2dpr output in some
directory. Now, run edm.com in this directory and redirect edm output to some
file. edm will be scan all *.pas files in the directory and create output file
in *.ddm format. Use deida.idc script for import the *.ddm file to IDA database.

Continue Reading

IDA Create Unicode String(English)

unconvert

IDA对Unicode的处理不能说很烂,但是有的时候却比较蛋疼。例如神马中文之类的,但是除此之外,对于英文的字符串处理在部分地方也是有问题的,例如上面的内容。

同样在idb刚创建的时候对于unicode字符串的解析也存在问题,例如下面的内容:

read

真正的字符串内容应该是ReadFromRegistry。但是ida很蛋疼的把第一个R当作dw给处理掉了,于是剩下了一个眉头的身子。

在创建string之后默认是采用的当前idb数据库的字符串格式,如果想要创建正确的字符串需要用到SetAsciiStyle(http://www.hex-rays.com/products/ida/support/idadoc/613.shtml)。

Continue Reading